Manual Penetration Testing

Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network. It often involves launching real attacks on real systems and data that use tools and techniques commonly used by attackers. Most penetration tests involve looking for combinations of vulnerabilities on one or more systems that can be used to gain more access than could be achieved through a single vulnerability.

Penetration testing can also be useful for determining:

1. How well the system tolerates real world-style attack patterns
2. The likely level of sophistication an attacker needs to successfully compromise the system
3. Additional countermeasures that could mitigate threats against the system
4. Defenders’ ability to detect attacks and respond appropriately.

Secure Sec Ltd utilizes the NIST methodology which is a widely adopted approach to performing penetration testing that is effective in testing the security of the CLIENT’s network. All of the examinations are conducted with publicly available and commercial tools.

External Penetration Tests follow best practice in penetration testing methodologies which generally includes 4 phases:

1. Planning Phase:

In the planning phase, rules are identified, management approval is finalized and documented, and testing goals are set. The planning phase sets the groundwork for a successful penetration test. No actual testing occurs in this phase.

2. Discovery Phase:

The discovery phase of penetration testing includes two parts. The first part is the start of actual testing, and covers information gathering and scanning. Network port and service identification is conducted to identify potential targets. In addition to port and service identification, other techniques are used to gather information on the targeted network

• Host name and IP address information can be gathered through many methods, including DNS interrogation, InterNIC (WHOIS) queries, and network sniffing (generally only during internal tests)
• Employee names and contact information can be obtained by searching the organization’s Web servers or directory servers
• System information, such as names and shares can be found through methods such as NetBIOS enumeration (generally only during internal tests) and Network Information System (NIS) (generally only during internal tests)
• Application and service information, such as version numbers, can be recorded through banner grabbing.

The second part of the discovery phase is vulnerability analysis, which involves comparing the services, applications, and operating systems of scanned hosts against vulnerability databases (a process that is automatic for vulnerability scanners) and the testers’ own knowledge of vulnerabilities.

3. Attack Phase:

Executing an attack is at the heart of any penetration test and represents the individual steps of the attack phase—the process of verifying previously identified potential vulnerabilities by attempting to exploit them. While vulnerability scanners check only for the possible existence of a vulnerability, the attack phase of a penetration test exploits the vulnerability to confirm its existence. If an attack is successful, the vulnerability is verified and safeguards are identified to mitigate the associated security exposure.

In many cases, exploits that are executed do not grant the maximum level of potential access to an attacker. They may instead result in the testers learning more about the targeted network and its potential vulnerabilities, or induce a change in the state of the targeted network’s security. Some exploits enable testers to escalate their privileges on the system or network to gain access to additional resources.

4. Reporting Phase:

The reporting phase occurs simultaneously with the other three phases of the penetration test. In the planning phase, the assessment plan—or ROE—is developed. In the discovery and attack phases, written logs are usually kept and periodic reports are made to system administrators and/or management. At the conclusion of the test, Secure Sec Ltd prepares a report that describes identified vulnerabilities, present a risk rating, and give guidance on how to remediate the discovered weaknesses.